Re: Fwd: uninitialized buffer in midnight commander

[Pavel Roskin <proski gnu org>]

On Tue, 23 Sep 2003, Thomas Jarosch wrote:

> Hello!
>
> I've seen this posting on bugtraq, but it looks like Ilya Teterin didn't
> care to contact the authors of mc. Forgive me if I'm wrong :-)

Thank you for your report.  I confirm that the bug is still present in the
CVS version.  Indeed, vfs_s_resolve_symlink() uses buffer of fixed size
but never checks if its size is sufficient.

There are still places in the VFS code that were written without any
thought of security.

-- 
Regards,
Pavel Roskin